It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xdg-user-dirs packages installed that are affected by a vulnerability:

  - It was found that the system umask policy is not being     honored when creating XDG user directories (~/Desktop     etc) on first login. This could lead to user's files     being inadvertently exposed to other local users.
    (CVE-2017-15131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the xdg-user-dirs package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that the system umask policy is not being     honored when creating XDG user directories (~/Desktop     etc) on first login. This could lead to user's files     being inadvertently exposed to other local     users.(CVE-2017-15131)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user's files being inadvertently exposed to other local users.(CVE-2017-15131)

Security Fix(es) :

  - xdg-user-dirs, gnome-session: Xsession creation of XDG     user directories does not honor system umask policy     (CVE-2017-15131)

Additional Changes :

An update for xdg-user-dirs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

xdg-user-dirs is a tool to create and configure default desktop user directories such as the Music and the Desktop directories.

Security Fix(es) :

* xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

From Red Hat Security Advisory 2018:0842 :

An update for xdg-user-dirs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

xdg-user-dirs is a tool to create and configure default desktop user directories such as the Music and the Desktop directories.

Security Fix(es) :

* xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:0842 advisory.

  - xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy     (CVE-2017-15131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
127188	NewStart CGSL CORE 5.04 / MAIN 5.04 : xdg-user-dirs Vulnerability (NS-SA-2019-0026)	Nessus	NewStart CGSL Local Security Checks	high
110845	EulerOS 2.0 SP3 : xdg-user-dirs (EulerOS-SA-2018-1181)	Nessus	Huawei Local Security Checks	high
110447	Amazon Linux 2 : xdg-user-dirs (ALAS-2018-1030)	Nessus	Amazon Linux Local Security Checks	high
109459	Scientific Linux Security Update : xdg-user-dirs on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	high
109373	CentOS 7 : xdg-user-dirs (CESA-2018:0842)	Nessus	CentOS Local Security Checks	high
109107	Oracle Linux 7 : xdg-user-dirs (ELSA-2018-0842)	Nessus	Oracle Linux Local Security Checks	high
108987	RHEL 7 : xdg-user-dirs (RHSA-2018:0842)	Nessus	Red Hat Local Security Checks	high
106166	EulerOS 2.0 SP2 : xdg-user-dirs (EulerOS-SA-2018-1025)	Nessus	Huawei Local Security Checks	high
106165	EulerOS 2.0 SP1 : xdg-user-dirs (EulerOS-SA-2018-1024)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2017-15131

high

Tenable Plugins

high

high

high

high

high

high

high

high

high